---
id: CVE-2026-88058
title: >-
  Angular is a development platform for building mobile and desktop web
  applications using TypeScript/JavaScript and other languages
summary: >-
  Angular is a development platform for building mobile and desktop web
  applications using TypeScript/JavaScript and other languages. Prior to
  20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in
  @angular/platform-server se…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
  - CWE-116
vendor: angular
product: angular
affected:
  - 'angular >= 19.0.0, <= 19.2.25'
  - 'angular >= 20.0.0, < 20.3.30'
  - 'angular >= 21.0.0, < 21.2.22'
  - 'angular >= 22.0.0, < 22.1.4'
patched:
  - angular 22.1.4
published: '2026-09-10'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T19:01:24.747'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88058'
references:
  - url: >-
      https://github.com/angular/angular/commit/73d8bbd27cb46495426d4132975a1355b47ad915
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/angular/commit/89b20568dfaee1ec8e0b3bcf1872acdddd2f4fef
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/angular/commit/ba3bc47b20b3d12f5eb141ec9c651373ae4d15e8
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/issues/70146'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v20.3.30'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v21.2.22'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/releases/tag/v22.1.4'
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4'
    label: security-advisories@github.com
  - url: >-
      https://github.com/angular/domino/commit/04f987dc08ff3736b427f50941adf1722458528f
    label: security-advisories@github.com
  - url: 'https://github.com/angular/angular/issues/70146'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/angular/angular/security/advisories/GHSA-j3r3-mxqp-r2p4'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88058'
  - url: 'https://github.com/advisories/GHSA-j3r3-mxqp-r2p4'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
  - score-dispute
epss: 0.00281
epssPercentile: 0.20487
aliases:
  - GHSA-j3r3-mxqp-r2p4
ecosystem: npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-11T15:14:28.505071Z'
scores:
  nvd: 6.1
  cna: 8.6
ingestedAt: '2026-09-12T20:04:42.956Z'
---

## Overview

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped greater-than characters but left less-than characters untouched and did not inspect fallback ancestors, so data such as a matching closing tag prematurely terminates noscript, iframe, noembed, or noframes containers. The vulnerable nodes cannot be authored through standard Angular templates; reachability requires application or library code using inject(DOCUMENT).createProcessingInstruction with attacker-controlled data or Renderer2 DOM insertion inside a fallback container. In HTML5 RAWTEXT parsing, the premature close causes subsequent sibling elements to be interpreted as live HTML and enables arbitrary JavaScript execution in a victim's browser. This issue is fixed in versions 20.3.30, 21.2.22, and 22.1.4.

## Affected

- `angular >= 19.0.0, <= 19.2.25`
- `angular >= 20.0.0, < 20.3.30`
- `angular >= 21.0.0, < 21.2.22`
- `angular >= 22.0.0, < 22.1.4`

## Remediation

Upgrade past the affected range:

- `angular 22.1.4`

## Package advisory (CVE-2026-88058)

Affected packages:

- `@angular/platform-server >= 22.0.0, < 22.1.4`
- `@angular/platform-server >= 21.0.0, < 21.2.22`
- `@angular/platform-server >= 20.0.0, < 20.3.30`
- `@angular/platform-server <= 19.2.25`

Patched in:

- `@angular/platform-server 22.1.4`
- `@angular/platform-server 21.2.22`
- `@angular/platform-server 20.3.30`

Source: https://github.com/advisories/GHSA-j3r3-mxqp-r2p4